OrthoIndy & OrthoIndy Hospital (“OrthoIndy”) Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Our Pledge To You. Your health information – which means any written or oral information that we create or receive that describes your health condition, treatment or payments – is personal. Therefore, OrthoIndy pledges to protect your health information as required by law. We give you this Privacy Notice to tell you (1) how we will use and disclose your protected health information, or “PHI” and (2) how you can exercise certain individual rights related to your PHI as a Patient of ours. Please note that if any of your PHI qualifies as mental health records, alcohol and drug treatment records, communicable disease records or genetic test records, we will safeguard these records as “Special PHI” which will be disclosed only with your prior express written authorization, pursuant to a valid court order or as otherwise required by law. We are required by law to maintain the privacy of your PHI and to provide you with this notice of our legal duties and privacy practices.

How We Will Use and Disclose Your PHI

A. To Provide Treatment. We may use and disclose your PHI to provide, coordinate or manage your health care and any related services. This includes the management or coordination of your health status and care with another health care provider. For example, we may disclose your PHI to a pharmacy to fill a prescription or to a laboratory to order a blood test. We may also disclose your PHI to another physician who may be treating you or consulting with us regarding your care.

B. Hospital Directory. Unless you notify us that you object, the following PHI about you will be placed in our hospital directory: your name, your room number, your condition described in general terms and your religious affiliation, if any. We may disclose this PHI to members of the clergy, or except for your religious affiliation, to others who contact us and ask for information about you by name.

C. To Obtain Payment. We may also use and disclose your PHI, as needed, to obtain payment for services that we provide to you. This may include certain communications to your health insurer or health plan to confirm (1) your eligibility for health benefits, (2) the medical necessity of a particular service or procedure, or (3) any prior authorization or utilization review requirements. We may also disclose your PHI to another health care provider involved in your care for the other provider’s payment activities. For example, this may include disclosure of demographic information to another physician practice that is involved in your care, or to a hospital where you were recently hospitalized, for payment purposes.

D. To Perform Health Care Operations. We may also use or disclose your PHI, as necessary, to carry on our day-to-day health care operations and to provide quality care to all of our Patients, but only on a “need to know” basis. These health care operations may include such activities as: quality improvement; physician and employee reviews; health professional training programs, including those in which students, trainees or practitioners in health care learn under supervision; accreditation; certification; licensing or credentialing activities; compliance reviews and audits; defending a legal or administrative claim; business management development; and other administrative activities. In certain situations, to the extent permitted by law we may also disclose your PHI to another health care provider or health plan to conduct their own particular health care operation requirements.

E. To Contact You. To support our treatment, payment and/or health care operations, we or our Business Associate, may contact you by telephone (mobile, home or work) or mail, from time to time to, (1) remind you of an upcoming appointment date, (2) perform health care operations (e.g. patient surveys for quality improvement purposes), or (3) ask you to return a call to OrthoIndy, unless you request in writing to the Privacy Officer (see contact information below), to use alternative means to communicate with you or restrict a certain means of communication regarding these matters. We may also contact you by telephone to inform you of specific test results or treatment plans, but only with your prior written authorization. Other arrangements to communicate by email or another method of communication may require prior written authorization.

F. To Be in Contact With Your Family or Friends. Additionally, we may also disclose certain information of your PHI to your family member or other relative, a close personal friend or any other person specified by you from time to time, but only if the PHI is directly related (1) to the person’s involvement in your treatment or related payments, or (2) to notify the person of your physical location or a sudden change in your condition, while receiving treatment at our facility. Although you have a right to request reasonable restrictions on these disclosures, we will only be able to grant those restrictions that are reasonable and not too difficult to administer, none of which would apply in the case of an emergency.

G. To Conduct Research. Under certain circumstances, we may use and disclose certain of your PHI for research purposes, but only if the research is subject to special approval procedures and the necessary rules governing uses and disclosures are agreed to by the researchers. For example, a research project may compare two different medications used to treat a particular condition in two different groups of Patients by comparing the Patients’ health and recovery in one group with the second group. Any other research will require your written authorization.

H. According to Laws That Require or Permit Disclosure. We may disclose your PHI when we are required or permitted to do so by any federal, state or local law, as follows:

  1. When There Are Risks to Public Health. We may disclose your PHI to (1) report disease, injury or disability; (2) report vital events such as births and deaths; (3) conduct public health activities; (4) collect and track FDA-related events and defects; (5) notify appropriate persons regarding communicable disease concerns; or (6) inform employers about particular workforce issues.
  2. To Report Suspected Abuse, Neglect or Domestic Violence. We may notify government authorities if we believe that a Patient is the victim of abuse, neglect or domestic violence, but only when specifically required or authorized by law or when the Patient agrees to the disclosure.
  3. To Conduct Health Oversight Activities. We may disclose your PHI to a health oversight agency for activities including audits; civil, administrative, or criminal investigations, proceedings, or actions; inspections; licensure or disciplinary actions; or other activities necessary for appropriate oversight, but we will not disclose your PHI if you are the subject of an investigation and your PHI is not directly related to your receipt of health care or public benefits.
  4. In Connection with Judicial and Administrative Proceedings. We may disclose your PHI in the course of any judicial or administrative proceeding in response to an order of a court or administrative tribunal. In certain circumstances, we may disclose your PHI in response to a subpoena if we receive satisfactory assurances that you have been notified of the request or that an effort was made to secure a protective order.
  5. For Law Enforcement Purposes. We may disclose your PHI to a law enforcement official to, among other things, (1) report certain types of wounds or physical injuries, (2) identify or locate certain individuals, (3) report limited information if you are the victim of a crime or if your health care was the result of criminal activity, but only to the extent required or permitted by law.
  6. To Coroners, Funeral Directors and for Organ Donation. We may disclose PHI to a coroner or medical examiner for identification purposes, to determine cause of death or for the coroner or medical examiner to perform other duties. We may also disclose PHI to a funeral director in order to permit the funeral director to carry out their duties. PHI may also be disclosed for organ, eye or tissue donation purposes.
  7. In the Event of a Serious Threat to Health or Safety or For Specific Government Functions. We may, consistent with applicable law and ethical standards of conduct, use or disclose your PHI if we believe, in good faith, that such use or disclosure is necessary to prevent or lessen a serious and imminent threat to your health or safety or to the health and safety of the public, or for certain other specified government functions permitted by law.
  8. For Worker’s Compensation. We may disclose your PHI to comply with worker‘s compensation laws or similar programs.
  9. To Communicate With You Regarding Your Treatment. We may also communicate information to you, from time to time, that may encourage you to use or purchase a particular product or service, but only as it relates to your treatment and only when permitted by HIPAA.
  10. To Provide Proof of Immunization. We will disclose proof of immunization to a school that is required to have it before admitting a student where you have agreed to the disclosure on behalf of yourself or your dependent.

I. With Your Prior Express Written Authorization. Other than as stated above or otherwise provided under state or federal law, we will not disclose your PHI, or more importantly, your Special PHI, without first obtaining your express written authorization. We will not use or disclose your PHI in any of the following situations without your written authorization:

  1. Uses and disclosures of Special PHI (if recorded by us in the medical record): except to carry out your treatment, payment or health care operations, to the extent permitted or required by law;
  2. Uses and disclosures of PHI: to conduct certain marketing activities that may encourage you to use or purchase a particular product or service for which HIPAA requires your prior express written authorization;
  3. Disclosures of PHI that constitutes a sale of your PHI under HIPAA;
  4. Psychotherapy notes; and
  5. Other uses and disclosures not described in this Notice.

II. Your Individual Rights Concerning Your PHI

A. The Right to Request Restrictions on How We Use and Disclose Your PHI. You may ask us not to use or disclose certain parts of your PHI but only if the request is reasonable. For example, if you pay for a particular service in full, out-of-pocket, on the date of service, you may ask us not to disclose any related PHI to your health plan. You may also ask us not to disclose your PHI to certain family members or friends who may be involved in your care or for other notification purposes described in this Privacy Notice, or how you would prefer us to communicate with you regarding upcoming appointments, treatment alternatives and the like by contacting you at a telephone number or address other than at home. Please note that we are only required to agree to those restrictions that are reasonable and which are not too difficult for us to administer. We will notify you if we deny any part of your request, but if we are able to agree to a particular restriction, we will communicate and comply with your request, except in the case of an emergency. Under certain circumstances, we may choose to terminate our agreement to a restriction if it becomes too burdensome to carry out. Finally, please note that it is your obligation to notify us if you wish to change or update these restrictions after your visit by contacting the Privacy Officer directly.

B. The Right to Receive Confidential Communications of PHI. You may request to receive communications of PHI from us by alternative means or at alternative locations, and we will work with you to reasonably accommodate your request. For example, if you prefer to receive communications of PHI from us only at a certain address, phone number or other method, you may request such a method.

C. The Right to Inspect and Copy Your PHI. You may inspect and obtain a copy of your PHI that we have created or received as we provide your treatment or obtain payment for your treatment. A copy may be made available to you either in paper or electronic format if we use an electronic health format. Under federal law, however, you may not inspect or copy the following records: psychotherapy notes; information compiled in reasonable anticipation of, or for use in, a civil, criminal or administrative action or proceeding; and PHI that is subject to a law prohibiting access. Depending on the circumstances, you may have the right to request a second review if your request to access your PHI is denied. Please note that you may not inspect or copy your PHI if your physician believes that the access requested is likely to endanger your life or safety or that of another person, or if it is likely to cause substantial harm to another person referenced within the information; or if another exception to deny access under state or federal law apply. As before, you have the right to request a second review of this decision. To inspect and copy your PHI, you must submit a written request to the Health Information Management (HIM) Department. We may charge you a fee for the reasonable costs that we incur in processing your request in accordance with state and federal laws.

D. The Right to Request Amendments to Your PHI. You may request that your PHI be amended so long as it is a part of our official Patient Record. All such requests must be in writing and directed to the HIM Department and/or Privacy Officer. In certain cases, we may deny your request for an amendment. If we deny your request for amendment, you have the right to file a statement of disagreement with us and we may respond to your statement in writing and provide you with a copy.

E. The Right to Receive an Accounting of Disclosures of PHI. You have the right to request an accounting of those disclosures of your PHI that we have made for reasons other than those for treatment, payment and health care operations, which are specified in Section II (A-C) above. The accounting is not required to report PHI disclosures: (1) to those family, friends and other persons involved in your treatment or payment, (2) that you otherwise requested in writing, (3) that you agreed to by signing an authorization form, or (4) that we are otherwise required or permitted to make by law. As before, your request must be made in writing to the HIM Department and/or Privacy Officer. The request should specify the time period, but please note that accounting requests may not be made for periods of time in excess of the past six (6) years. We will provide the first accounting you request during any twelve (12) month period without charge. Subsequent accounting requests may be subject to a reasonable cost-based fee.

F. The Right to Receive Notice of a Breach. You have the right to receive written notice in the event we learn of any unauthorized acquisition, use or disclosure of your PHI that was not otherwise properly secured as required by HIPAA. We will notify you of the breach as soon as possible but no later than sixty (60) days after the breach has been discovered.

G. The Right to File a Complaint. You have the right to contact our Privacy Officer at any time if you have questions, comments or complaints about our privacy practices or if you believe we have violated your privacy rights. You also have the right to contact our Privacy Officer or the Department of Health and Human Services’ Office for Civil Rights regarding these privacy matters, particularly if you do not believe that we have been responsive to your concerns. We urge you to contact our Privacy Officer if you have any questions, comments or complaints, either in writing or by telephone as follows:

OrthoIndy
Attn: Mark Muntel, Chief Information Officer
8450 Northwest Boulevard
Indianapolis, Indiana 46278
[P] 317.802.2060
[E] mmuntel@orthoindy.com

Please note that we will not take any action, or otherwise retaliate, against you in any way as a result of your communications to OrthoIndy or to the Department of Health and Human Services’ Office for Civil Rights. As always, please feel free contact us. We look forward to serving you as a Patient.

H. Your Right to Revoke Authorization. Any other uses and disclosures not described in this notice will be made only with your written authorization. Please note that you may revoke your authorization in writing at any time except to the extent that we have taken action in reliance upon the authorization.